<!DOCTYPE html
  PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
  "DTD/xhtml1-strict.dtd">
<html>
  <head>
    <title>volatility.plugins.overlays.windows.windows : API documentation</title>
    <meta content="text/html;charset=utf-8" http-equiv="Content-Type" />
    <link href="apidocs.css" type="text/css" rel="stylesheet" />
    
    
  </head>
  <body>
    <h1 class="module">v.p.o.w.windows : module documentation</h1>
    <p>
      <span id="part">Part of <a href="volatility.html">volatility</a>.<a href="volatility.plugins.html">plugins</a>.<a href="volatility.plugins.overlays.html">overlays</a>.<a href="volatility.plugins.overlays.windows.html">windows</a></span>
      
      
    </p>
    <div>
      
    </div>
    <div class="undocumented">No module docstring</div>

    
    
    <div id="splitTables">
      <table class="children sortable" id="id632">
  
  
<tr class="class">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows.WinTimeStamp.html">WinTimeStamp</a></td>
    <td><span>Class for handling Windows Time Stamps</span></td>
  </tr><tr class="class">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows.ThreadCreateTimeStamp.html">ThreadCreateTimeStamp</a></td>
    <td><span>Handles ThreadCreateTimeStamps which are bit shifted WinTimeStamps</span></td>
  </tr><tr class="class">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows.VolatilityKPCR.html">VolatilityKPCR</a></td>
    <td><span>A scanner for KPCR data within an address space</span></td>
  </tr><tr class="class">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows.VolatilityMaxAddress.html">VolatilityMaxAddress</a></td>
    <td><span>The maximum address of a profile's underlying AS.</span></td>
  </tr><tr class="class">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows.VolatilityKDBG.html">VolatilityKDBG</a></td>
    <td><span>A Scanner for KDBG data within an address space</span></td>
  </tr><tr class="class">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows.VolatilityIA32ValidAS.html">VolatilityIA32ValidAS</a></td>
    <td><span>An object to check that an address space is a valid IA32 Paged space</span></td>
  </tr><tr class="class">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows.WindowsOverlay.html">WindowsOverlay</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="class">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows.WindowsVTypes.html">WindowsVTypes</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="class">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows.WindowsObjectClasses.html">WindowsObjectClasses</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="class">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows.AbstractKDBGMod.html">AbstractKDBGMod</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="class private">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows._UNICODE_STRING.html">_UNICODE_STRING</a></td>
    <td><span>Class representing a _UNICODE_STRING</span></td>
  </tr><tr class="class private">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows._LIST_ENTRY.html">_LIST_ENTRY</a></td>
    <td><span>Adds iterators for _LIST_ENTRY types</span></td>
  </tr><tr class="class private">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows._EPROCESS.html">_EPROCESS</a></td>
    <td><span>An extensive _EPROCESS with bells and whistles</span></td>
  </tr><tr class="class private">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows._TOKEN.html">_TOKEN</a></td>
    <td><span>A class for Tokens</span></td>
  </tr><tr class="class private">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows._ETHREAD.html">_ETHREAD</a></td>
    <td><span>A class for threads</span></td>
  </tr><tr class="class private">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows._HANDLE_TABLE.html">_HANDLE_TABLE</a></td>
    <td><span>A class for _HANDLE_TABLE.</span></td>
  </tr><tr class="class private">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows._OBJECT_HEADER.html">_OBJECT_HEADER</a></td>
    <td><span>A Volatility object to handle Windows object headers.</span></td>
  </tr><tr class="class private">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows._FILE_OBJECT.html">_FILE_OBJECT</a></td>
    <td><span>Class for file objects</span></td>
  </tr><tr class="class private">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows._MMVAD.html">_MMVAD</a></td>
    <td><span>Class factory for _MMVAD objects</span></td>
  </tr><tr class="class private">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows._MMVAD_SHORT.html">_MMVAD_SHORT</a></td>
    <td><span>Class with convenience functions for _MMVAD_SHORT functions</span></td>
  </tr><tr class="class private">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows._MMVAD_LONG.html">_MMVAD_LONG</a></td>
    <td><span>Subclasses _MMVAD_LONG based on _MMVAD_SHORT</span></td>
  </tr><tr class="class private">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows._EX_FAST_REF.html">_EX_FAST_REF</a></td>
    <td><span class="undocumented">No class docstring; 1/1 methods documented</span></td>
  </tr><tr class="class private">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows._IMAGE_DOS_HEADER.html">_IMAGE_DOS_HEADER</a></td>
    <td><span>DOS header</span></td>
  </tr><tr class="class private">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows._IMAGE_NT_HEADERS.html">_IMAGE_NT_HEADERS</a></td>
    <td><span>PE header</span></td>
  </tr><tr class="class private">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows._IMAGE_SECTION_HEADER.html">_IMAGE_SECTION_HEADER</a></td>
    <td><span>PE section</span></td>
  </tr><tr class="class private">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows._CM_KEY_BODY.html">_CM_KEY_BODY</a></td>
    <td><span>Registry key</span></td>
  </tr><tr class="class private">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows._MMVAD_FLAGS.html">_MMVAD_FLAGS</a></td>
    <td><span>This is for _MMVAD_SHORT.u.VadFlags</span></td>
  </tr><tr class="class private">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows._MMVAD_FLAGS2.html">_MMVAD_FLAGS2</a></td>
    <td><span>This is for _MMVAD_LONG.u2.VadFlags2</span></td>
  </tr><tr class="class private">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows._MMSECTION_FLAGS.html">_MMSECTION_FLAGS</a></td>
    <td><span>This is for _CONTROL_AREA.u.Flags</span></td>
  </tr><tr class="class private">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.overlays.windows.windows._POOL_HEADER.html">_POOL_HEADER</a></td>
    <td><span>A class for pool headers</span></td>
  </tr>
  
</table>
      
      
    </div>
    
    
    

    
    <address>
      <a href="index.html">API Documentation</a> for Volatility 2.2, generated by <a href="http://codespeak.net/~mwh/pydoctor/">pydoctor</a> at 2013-06-24 15:16:10.
    </address>
  </body>
</html>